Cloudanix VulnDB

CVE-2025-68240

None

CVSS

—

EPSS

0.2%

Published

Dec 16, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux file system code could let someone with access to the computer crash it or run unauthorized code, so updating the system software is needed to prevent problems.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in nilfs2 due to sc_timer remaining active after kthread_stop returns -EINTR in nilfs_segctor_destroy, allowing the timer to reference freed sci structure during nilfs_construction_timeout.

Why it matters to the business

Systems using the nilfs2 filesystem face risk of kernel instability, crashes, or potential local privilege escalation, which can disrupt operations and require emergency patching especially on widely deployed Linux distributions.

How an attack unfolds

An attacker with local access triggers filesystem operations that invoke nilfs_put_super and nilfs_segctor_destroy under conditions where the segment constructor thread exit is interrupted, leaving the timer active and causing use-after-free when the sci object is freed.

How to fix it

Upgrade affected packages to fixed versions including rancher-agent-2.10 to 2.10.2-r2 or Linux kernel to commit 36049e81dc7f077e0e24d5b9688a7458beacef8f which applies timer_shutdown_sync and protects sc_task under sc_state_lock.

How to confirm the fix worked

Confirm kernel source contains the timer_shutdown_sync call in nilfs_segctor_destroy and absence of the ODEBUG timer_list warning on sci free; test by exercising nilfs2 mount/unmount sequences.

Typical attack path

  1. Obtain local user access on target system
  2. Create or mount a nilfs2 filesystem
  3. Perform operations that lead to log writer detachment and segment constructor destruction
  4. Trigger the race or error path causing incomplete timer shutdown
  5. Exploit the resulting use-after-free for crash or code execution

How to detect it

Review kernel logs for ODEBUG warnings referencing timer_list and nilfs_construction_timeout during nilfs_segctor_destroy or nilfs_put_super calls; inspect for unexpected crashes involving segment.c in nilfs2.

What your security team should do

  • Apply kernel or package updates to fixed versions immediately on any systems using nilfs2
  • Audit for nilfs2 filesystem usage across the environment
  • Restrict untrusted local access until patches are deployed
  • Monitor kernel logs for related timer warnings as a temporary detection measure

The record

In the Linux kernel, the following vulnerability has been resolved: nilfs2: avoid having an active sc_timer before freeing sci Because kthread_stop did not stop sc_task properly and returned -EINTR, the sc_timer was not properly closed, ultimately causing the problem [1] reported by syzbot when freeing sci due to the sc_timer not being closed. Because the thread sc_task main function nilfs_segctor_thread() returns 0 when it succeeds, when the return value of kthread_stop() is not 0 in nilfs_segctor_destroy(), we believe that it has not properly closed sc_timer. We use timer_shutdown_sync() to sync wait for sc_timer to shutdown, and set the value of sc_task to NULL under the protection of lock sc_state_lock, so as to avoid the issue caused by sc_timer not being properly shutdowned. [1] ODEBUG: free active (active state 0) object: 00000000dacb411a object type: timer_list hint: nilfs_construction_timeout Call trace: nilfs_segctor_destroy fs/nilfs2/segment.c:2811 [inline] nilfs_detach_log_writer+0x668/0x8cc fs/nilfs2/segment.c:2877 nilfs_put_super+0x4c/0x12c fs/nilfs2/super.c:509

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 6.12.0 6.12.59

Related vulnerabilities